如何使用 Boto3 将多个参数传递给 AWS SSM send_command

Question

我创建了一个自定义 AWS SSM 文档以与 Run Command 一起使用，然后我尝试使用 Boto 3 将该命令发送到单个 EC2 实例。

该文档需要发送 2 个参数，但我无法通过查看此处的文档来弄清楚如何正确执行此操作：https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ssm.html#SSM.Client.send_command

我可以通过以下命令成功使用 CLI：

aws ssm send-command \
    --document-name "ResetVpnMfa" \
    --document-version "1" \
    --targets '[{"Key":"InstanceIds","Values":["i-abcabcab"]}]' \
    --parameters '{"command":["GoogleAuthlock"],"username":["some.user"]}' \
    --timeout-seconds 30 \
    --region eu-west-1

我的 Python 代码：

import boto3

client = boto3.client('ssm', region_name='eu-west-1')

params={
    'command': ['GoogleAuthLock'],
    'username': ['some.user'],
}

response = client.send_command(
    InstanceIds=['i-abcabcab'],
    DocumentName='ResetVpnMfa',
    DocumentVersion='1',
    TimeoutSeconds=30,
    Comment='VPN MFA reset for some.user via Boto',
    Parameters=params
)

我收到以下错误：

botocore.errorfactory.InvalidParameters: An error occurred (InvalidParameters) when calling the SendCommand operation:

SSM 文档本身：

---
schemaVersion: "2.2"
description: "Unlock or reset MFA on OpenVPN"
parameters:
  username:
    type: "String"
    description: "VPN user e.g. digger.dachshund"
  command:
    type: "String"
    description: "Command to unlock or reset MFA on OpenVPN."
    allowedValues:
    - GoogleAuthlock
    - GoogleAuthRegen
mainSteps:
- action: "aws:runShellScript"
  name: "VPNResetMFA"
  inputs:
    runCommand:
    - "/usr/local/openvpn_as/scripts/sacli --user {{username}} --lock 0 {{command}}"

Answer 1

您的 SSM 文档和 Python 代码不匹配。您将GoogleAuthlock 拼错为GoogleAuthLock。参数变量是这样的，

params={
'command': ['GoogleAuthlock'],
'username': ['some.user'],

}